Advanced Threat Prevention Appliance

Advanced Threat Prevention Appliances are physical or virtual on-premises devices that combine advanced threat detection with consolidated security analytics to protect organizations from known and unknown cyberattacks while improving the productivity of security operations teams. Working with Juniper Networks SRX Series Services Gateways, ATP Appliances detect threats in Web, e-mail, and lateral traffic, blocking those threats if the firewall is deployed inline. ATP Appliances can also ingest logs from existing security devices and apply contextual analysis to provide a consolidated view of the threat landscape.

Juniper Networks^® Advanced Threat Prevention Appliances address the need for both on-premises physical and virtual threat detection and mitigation solutions.

Two hardware platforms are available—the JATP400 Advanced Threat Prevention Appliance and JATP700 Advanced Threat Prevention Appliance—which scale to support up to 130,000 processed files per day. The virtual version of the ATP Appliances, running on either VMware vSphere or ESXi, can be deployed with either 8 or 24 virtual CPU cores to process up to 116,000 files per day.

Juniper ATP Appliances collect web, e-mail, and lateral traffic using either the Juniper Networks SRX Series Services Gateways or its own built-in collector, making it an ideal fit for organizations employing multiple firewall solutions. Collected data is sent to an on-premises ATP Appliance for further processing by the ATP Appliance core, which identifies known and unknown threats and provides comprehensive analytics detailing the threat's progression within the environment by mapping detections to the attack kill chain. Once a threat is detected, the ATP Appliance sends firewall policy updates to the SRX Series firewalls. The ATP Appliance can also be configured to update policies on third-party firewalls from vendors such as Palo Alto Networks, Fortinet, and Cisco. Working with Juniper Networks EX Series Ethernet Switches, Juniper Networks QFX Series switches, or other third-party switches, JATP Appliances can also isolate threats and leverage one-touch mitigation to quarantine compromised hosts, limiting lateral spread.

The on-premises ATP solution can use SRX Series firewalls as collectors for inline detection and blocking. JATP Appliances can also use their built-in collectors with third-party firewalls. For MSSP environments, the ATP Appliance can be deployed as a separate collector and core supporting multi-tenancy. A collector is deployed at each customer location, and a core or cluster of cores analyzes all traffic. For air-gapped environments, the Juniper ATP Appliance can run in private mode, which provides malware detection, mitigation, and even correlation when Internet access is not available. 

Files and related executables collected across the network are delivered to the SmartCore detection and analytics engine on a JATP400 or JATP700 Appliance for further analysis. The SRX Series firewalls can block threats detected by the SmartCore engine.

ATP Appliances can also ingest logs from other identity and security solutions such as Active Directory, endpoint antivirus, firewalls, secure Web gateways, intrusion detection systems, and endpoint detection and response tools. The logs can be ingested either directly from third-party devices, or they can be forwarded by existing security information and event management (SIEM)/syslog servers.

ATP Appliances are available in both physical and virtual form factors. The physical appliances—the 1 U JATP400 and the 2 U JATP700—can be deployed in all-in-one mode (SmartCore and Fabric Collector installed on the same physical appliance) or in distributed mode (SmartCore and Fabric Collector installed on separate appliances). Virtual appliances can be deployed in distributed mode.

Malware detection for MacOS is also supported. Customers are required to provide Mac mini hardware that can be deployed as a secondary core. The MacOS sandboxing image is available on the ATP Appliances’ software downloads page.